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DETAILED ACTION 

1. This action is responsive to the communication filed on May 01, 2007. 
Claims 1-86 are pending. At this time, claims 1-40, 42-55, 57-70, and 72-85 are 
rejected. 

Election/Restrictions 

2. Applicant's election with traverse of Species 1 in the reply filed on May 
01, 2007 is acknowledged. 

Claims 41, 56, 71, and 86 are withdrawn by the applicant from further 
consideration pursuant to 37 CFR 1.142(b) as being drawn to a nonelected species 2. 
Election was made with traverse in the reply filed on May 01, 2007. This is not found 
persuasive because each of the various disclosed species details a mutual exclusive 
characteristic of: 

Species 1 is drawn to "A method, a system, and a computer-readable 
medium comprising: determining whether a source address for a first packet sent by the 
source address to a destination address qualifies as a threat; examining the first packet; 
and determining a response to the first packet based upon the examining and based 
upon whether the source address qualifies as the threat." 

Species 2 is drawn to "A method, a system, and a computer-readable 
medium comprising: examining a first packet sent by a source address to a destination 
address; determining whether the destination address is a synthetic hardware address; 
and when the destination address is the synthetic hardware address, modifying the first 
packet by replacing the destination address with a hardware address for a device to 
receive communication targeted to the destination address, and sending the first 
packet." 

These above individual species act as evidenced by the representation of 
each various species with a different figure or set of figures and a different in processing 
the steps. 

A search for one of these mutually exclusive characteristics is not 
coextensive with a search for the other mutually exclusive characteristics and therefore 
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searching for all mutually exclusive characteristics could not be done without serious 
burden. The requirement is still deemed proper and is therefore made FINAL. 

Claim Rejections - 35 USC § 101 

3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition 
of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

4. Claims 1-40, 42-55, 57-70, and 72-85 are rejected under 35 U.S.C. 101 
because the claimed invention is directed to non-statutory subject matter. 

a. Referring to claim 72: 

1. Claim 72 recites "A computer-readable medium comprising: 
threat-determining instructions configured to determine whether a source address for a 
first packet sent by the source address to a destination address qualifies as a threat; 
examining instructions configured to examine the first packet; and response-determining 
instructions configured to determine a response to the first packet based upon the 
examining and whether the source address qualifies as the threat." The claim is directed 
toward a software program, and this is a non-statutory subject matter. Furthermore, 
applicant has pointed out in the specification (see paragraph 0116 of page 22 of 
specification) "The instructions 338 may include various operating instructions and 
computer-implemented instructions for implementing the methods herein, among 
others. T/iese instructions may take the form of interpretive instructions, 
programs, and additional data, among ottiers .". which clearly including intangible 
media such as signals, carrier waves, transmissions, optical waves, transmission media 
or other media incapable of being touched or perceived absent the tangible medium 
through which they are conveyed. Therefore, claim 72 recites a non-statutory subject 
matter. 

b. Referrinp to claims 1. 42, 57: 

i. These claims consist a method and a system to implement 
claim 72, thus they are rejected with the same rationale applied against claim 72 above. 

c. Referring to claims 2-39. 43-55. 58-70. 73-85: 
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i. These claims are dependent claims of either 1 , 42, 57, and 
72, thus they are rejected with the same rationale applied against claims 1 , 42, 57, and 
72 above. 

Claim Rejections • 35 USC § 102 

5. The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this Office 
action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

6. Claims 1, 21, 26-28. 36, 39-40. 42, 50, 53-55, 57, 69-70, 72, 80, and 85 
are rejected under 35 U.S.C. 102(e) as being anticipated by Trcka et al (US 6,453,345 
B2). 

a. Referring to claim 1: 

i. . Trcka teaches a method comprising: 

(1) determining whether a source address for a first 
packet sent by the source address to a destination address qualifies as a threat 
(column 14, lines 61-67; column 15, lines 36-57 of Trcka); 

(2) examining the first packet (column 15, line 58 
through column 16, line 4 of Trcka); and 

(3) determining a response to the first packet based upon 
the examining and based upon whether the source address qualifies as the threat 
(column 15, line 58 through column 16, line 4 of Trcka). 

b. Referring to claim 21: 

i. Trcka further teaches: 
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(1) when the source address fails to qualify as the threat, 
determining whether the destination address qualifies as a second threat (column 14, 
lines 61-67; column 15, lines 36-57 of Trcka). 

c. Referring to claim 26: 

i. Trcka further teaches: 

(1) when the source address qualifies as the threat, 
determining a packet type of the first packet (column 14, lines 61-67; column 15, lines 
36-57; and column 18, lines 3-7 of Trcka). 

d. Referring to claim 27: 

I Trcka further teaches: 

(1) when the packet type of the first packet is an address 
resolution protocol request (column 1, lines 45-48; column 2, lines 49-56; and 
column 7, lines 57-67 of Trcka), determining that the response comprises creating a 
reply comprising the destination address as a reply source address, and sending the 
reply to the source address (column 15, line 36 through column 16, line 4 of Trcka). 

e. Referring to claim 28: 

I This claim has limitations that is similar to those of 
claim 27, thus it is rejected with the same rationale applied against claim 27 above. 

f. Referring to claim 36: 

I Trcka further teaches: 

(1) performing the response (column 14, lines 61-67; 
column 15, lines 36-57 of Trcka). 

g. Referring to claim 39: 

I Trcka further teaches: 

(1) wherein the examining the first packet comprises 
examining a header for the first packet (column 6, lines 13-16; column 16, lines 49-55 
of Trcka). 

h. Referring to claim 40: 

i. Trcka further teaches: 
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(1) wherein the examining the first packet does not 
comprise examining a payload for the first packet (column 18, lines 3-14 of Trcka). 

i. Referring to claims 42. 57. 72: 

i. These claims consist a system and computer- 
readable medium to implement claim 1, thus they are rejected with the same rationale 
applied against claim 1 above. 

j. Referring to claims 50. 80: 

i. These claims have limitations that is similar to those 
of claim 1 , thus they are rejected with the same rationale applied against claim 1 above. 
I. Referring to claims 53. 85: 

i. These claims have limitations that is similar to those 
of claim 26, thus they are rejected with the same rationale applied against claim 26 
above. 

m. Referring to claims 54. 69: 

i. These claims have limitations that is similar to those 
of claim 27, thus they are rejected with the same rationale applied against claim 27 
above. 

k. Referring to claims 55. 70: 

i. These claims have limitations that is similar to those 
of claim 36, thus they are rejected with the same rationale applied against claim 36 
above. 

Claim Rejections • 35 USC § 103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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8. Claims 2-5, 22-23, 43-46, , 51-52, 58-61 , 73-76, 81-82, are rejected under 
35 U.S.C. 103(a) as being unpatentable over Trcka et al (US 6,453,345 B2), and further 
in view of Thubert et al (US 6,865,184 B2). 

a. Referring to claim 2: 

i. Trcka further teaches: 

(1) when the source address qualifies as the threat 
(column 14, lines 61-67; column 15, lines 36-57 of Trcka). However, Trcka is silent 
on the capability of determining whether the destination address is synthetic. On the 
other hand, Thubert teaches this limitation in column 3, lines 42-59 of Thubert 

ii. It would have been obvious to a person having ordinary skill 
in the art at the time the invention was made to: 

(1) have modified the invention of Trcka with the teaching 
of Thubert for detecting and protecting against security breaches (both internal and 
external), network failures, and other types of data-compromising events (column 1, 
lines 12-15 of Trcka). 

iii. The ordinary skilled person would have been motivated to: 

(1 ) have modified the invention of Trcka with the teaching 
of Thubert to monitor and record the traffic present on a local area network, wide area 
network, or other type of computer network, without interrupting or otherwise interfering 
with the flow of the traffic (see Trcka's abstract, lines 1-5). 

b. Referring to claim 3: 

i. The combination of teaching between Trcka and Thubert 
teaches the claimed subject matter. Thubert further teaches: 

(1) when the destination address is determined to be 
synthetic (column 3, lines 42-59 of Thubert), determining the response to be dropping 
the first packet (see Figure 5B, element 236 and column 10, lines 63-64 and column 
12, line 49 of Thubert). 

c. Referring to claim 4: 

i. The combination of teaching between Trcka and Thubert 
teaches the claimed subject matter. Thubert further teaches: 



Application/Control Number: 10/676,637 
Art Unit: 2135 



Page 8 



(1) dropping the first packet (see Figure SB, element 
236 and column 10, lines 63-64 and column 12, line 49 of Thubert). 

d. Referring to claim 5: 

i. The combination of teaching between Trcka and Thubert 
teaches the claimed subject matter. Trcka further teaches: 

(1) when the destination address is determined to be not 
synthetic and the source address is the threat (column 14, lines 61-67; column 15, 
lines 36-57 of Trcka), determining whether the source address is on a local network 
(column 2, lines 11-14 of Trcka). 

f. Referhna to ciaim 22: 

i. This claim has limitations that is similar to those of claims 1- 
3, thus it is rejected with the same rationale applied against claims 1-3 above. 

g. Referring to ciaim 23: 

i. This claim has limitations that is similar to those of claim 4, 
thus it is rejected with the same rationale applied against claim 4 above, 
j. Referring to ciaims 43-46. 59-61. 73-76: 

i. These claims have limitations that is similar to those of 
claims 2-5, thus they are rejected with the same rationale applied against claims 2- 
5above. 

k. Referring to ciaims 51. 58. 81: 

i. These claims have limitations that is similar to those of claim 
2, thus they are rejected with the same rationale applied against claim 2 above. 
I. Referrinp to claims 52, 82: 

i. These claims have limitations that is similar to those of claim 
27, thus they are rejected with the same rationale applied against claim 27 above. 

9. Claims 37-38 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Trcka et al (US 6.453,345 B2), and further in view of Miyazaki et al (US 5,517,488). 
a. Referring to ciaims 37-38: 
i. Trcka further teaches: 
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(1) wherein tlie source address comprises at least one of 
a logical address and a physical address (column 18, lines 3-7 of Trcka). 

ii. Although Trcka teaches the source and destination 
addresses, Trcka is silent on the capability of showing source address and/or 
destination address includes the logical and physical addresses. On the other hand, 
Miyazaki teaches this limitation in Figures 3, 5, 6A-6B, and 8. 

iii. It would have been obvious to a person having ordinary skill 
in the art at the time the invention was made to: 

(1) have modified the invention of Trcka with the teaching 
of Miyazaki for detecting and protecting against security breaches (both internal and 
external), network failures, and other types of data-compromising events (column 1, 
lines 12-15 of Trcka). 

iv. The ordinary skilled person would have been motivated to: 
(1) have modified the invention of Trcka with the teaching 

of Miyazaki to monitor and record the traffic present on a local area network, wide area 
network, or other type of computer network, without interrupting or othenwise interfering 
with the flow of the traffic (see Trcka's abstract, lines 1-5). 

Conclusion 

1 0. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

a. Schell et al (US 6,477,648 B1) discloses a trusted workstation in a 
networked client/server computing system (see Title). 

Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to Thanhnga (Tanya) Truong 
whose telephone number is 571-272-3858. 

If attempts to reach the examiner by telephone are unsuccessful, 
the examiner's supervisor, Kim Vu can be reached at 571-272-3859. The fax and 
phone numbers for the organization where this application or proceeding is assigned is 
571-273-8300. 
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Any inquiry of a general nature or relating to the status of this 
application or proceeding should be directed to the receptionist whose telephone 
number is 571-272-2100. 



June 29. 2007 




